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WTL Team 



UC Berkeley 

- Algorithm Design 

- Reachable Sets 

- Hybrid Mode Switching 

NASA Armstrong 

- WTL C Code 

- S/WV&V 

- HIL Simulation 

™ U. Tulsa 

THE UNIVERSITY of w " W 

TULSA 

- NYC Cost Map 

- S/W Requirements 
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Emergency Landings 
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Where To Land 


• Where To Land (WTL) is a emergency forced landing algorithm 
developed by UC Berkeley 

• Inflight emergency -> vehicle forced to land 

- What is the optimal landing location that will minimize loss of life and 
minimize property damage given a set of constraints 

- What is the optimal trajectory required for the aerial vehicle to reach 
optimal landing location? 

• WTL attempts to mimic an expert pilot’s decision making and 
land the aircraft 


Cruise 



WTL Concept of Operations 
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WTL Algorithm 



Fault 

Location 





Cost Map 


Loss Tolerance 



Reachable Sets 


Pre-Planning 


Emergency 

Trajectory 


State Estimator 


Real Time Update 


Updated 

Trajectory 


* 


Sensor 

Observations 


Pre-Planning - pre-compute trajectories using fault 
location, maps and reachable sets 


Real Time Update - adapt emergency trajectory based on 
real time data (weather, occupancy, etc.) 
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Innovation 


Prior Forced 
Landing Algorithms 


Where to Land 
Algorithm 



• Simple dynamics model 

• Assumes aircraft can return to runway 

• Difficult to apply to autonomous vehicles 

• Haven’t been flight tested 


• Provides safety guarantees for S/W V&V 

• Higher fidelity aircraft model 

• Fast computation 

• Manned or unmanned vehicles 

• Modular design 
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WTL1 Phase 1 Results 




► 


UC Berkeley Campus 


Emergency Trajectories 




Emergency Landing Location 



Demo: MATLAB sim 
Location: UC Berkeley 
Vehicle: Quadrotor 
Failure: 90% thrust 
2D Trajectory 
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Phase 1 Phase 2 



• Reduce the scope of WTL 

- Simplify WTL -> Speed up software development 

- Find “real world” design/implementation issues 

- Get pilot feedback with HIL simulation 

- Collect data to improve future versions 

• WTL1 WTL2 

- NASA TCM/B-757 aerodynamics model 

- No real time update -> compute trajectories during fault 

- No global cost map -> NYC/New Jersey area -100+ miles 

- No Fault detection -> One predefined fault, dual engine failure 

- HIL6DOF nonlinear aircraft simulation 


PHASE 2 • Demonstrate WTL in HIL simulation 
GOALS • Develop tools to generate reachable trajectories 
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WTL Development Plan 



Phase 1 - WTL1 


Demo: MATLAB Sim 
Location: UC Berkeley 
Vehicle: Quadrotor 
Failure: 90% reduction in thrust 
2D Trajectory 





Phase 2 - WTL2 


Demo: HIL Sim w/ FLS on embedded H/W 
Location: New York City +/- -100 miles 
Vehicle: 757 
Failure: Loss of thrust 
2D Trajectory 





Future Work 


Demo: Flight test RC Aircraft w/ Pixhawk 

Location: Edwards, CA 

Vehicle: RC Aircraft 

Failure: Loss of thrust 

2D Trajectory 
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WTL2 Architecture 
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WTL2 Algorithm 

1 . Get current aircraft state 

- Latitude/Longitude 

- Altitude/HeadingA/elocity 

2. Convert states to local frame 

3. Compute maximum glide range 

4. Window cost map with max range 

5. Get reachable set for altitude 

6. Scale and project reachable set over map with heading 

7. Find best reachable landing location using 2D convolution 

8. Generate trajectory using optimal path planner 

9. Generate latitude/longitude waypoints 

10. Generate target headings 
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HIL Simulation Architecture 
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Engine Out Scenario 



• Complete loss of thrust 

• Engine out during takeoff is the most critical 

- WTL2 Operational Range: 1000 ft - 4000 ft 

- Less than 1000 ft -> Can only land straight ahead 

- Greater than 4000 ft -> Can often return to airport 

- Glide range will vary based on aircraft and configuration (i.e. 
weight, flaps) 

• During failure -> pilots must manage energy 

• Flying at L/D MAX maximizes aircraft range 

• L/D max a MA x gross weight V GUDE 

• Flying at V GUDE will maximize aircraft range 
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Reachability 

Reachability - Given a dynamic system governed by some 
differential equation and input defined over some bounded 
state space. What are all the states visited by the trajectories 
of the system 

• Reachability is a key technology for 
verifying safety critical systems 7 

• Reachability assures that a system 
can reach a target state while 
remaining within a safety envelope 7 

• Level Set Toolbox - computes 
reachable sets of hybrid systems 
with continuous dynamics using 
nonlinear ODE’s 3 

• Grid based computation 


Forward reachable set stages 


02 ^ 


0 - 



xaxis 
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Aircraft Reachability 

Aircraft Reachability is gliding aircraft model with NASATCM aerodynamics 
formulated as a PDE (HJ) and solved using the Level Set Toolbox. Aircraft 
trajectory has two modes. The two mode states are stitched together using 


a hybrid system model. 

Mode 1 - Approach Mode 

• TCM aerodynamics 

• Glide equations 

• Glide velocity 

• Constant radius turns 

• State constraints 
Mode 2 - Landing Mode 

• TCM 30° flap aerodynamics 

• Landing velocity 

• State constraints 
States 

• Aircraft position 

• Velocity 

• Flight path and heading angles 

Control 

• Angle of attack 

• Bank angle 

www.nasa.gov 
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Reachable Set 



www.nasa.gov 


Reachable sets are a set of initial 
states from which the system is 
guaranteed to remain inside a 
safe region while eventually 
reaching a desired target 3 


State Constraints 

V - Stall avoidance 
a, <(> - Keeps aircraft within 
performance envelope 
Acceleration - structural load limits 


17 


National Aeronautics and Space Administration 


Discrete Reachable Sets 




• Reachable sets generated every 1 00 ft from 1 000 ft - 4000 ft 

• Grid size 10E4x10E4 ft 

• Normalized and stored as a binary map 

• Oriented onto global map using aircraft heading 
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Cost Map 



• Hazard Map - constructed from population and geographical data 

• Impact Map - constructed from density maps, land use maps, etc. 

• Total Loss Map = Hazard Map + Impact Map 

• Map Size: 7201x5401 pixels (3.5+ million pixels) 



1000 


2000 


3000 


4000 
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5000 


NYC Impact Map 


0 1000 2000 
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Gliding Aircraft Equations 


• 3D motion of gliding aircraft over flat Earth 

• Model assumes coordinated turns, no sideslip 



Aircraft velocities 


Aircraft acceleration 

Flight path derivative 
Heading derivative 


Optimum glide velocity 
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NASA TCM Model 

• Nonlinear aircraft model 
developed by NASA Langley for 
NASA’s Aviation Safety Program 

• Transport Class Model (TCM) 
closely replicates B-757 
aerodynamics 

• For WTL2, TCM aerodynamics 
tables (C L ,C D ) are used 

• On landing transition to 30° Flap 
aerodynamics 

• Compute L/D max and a MAX 
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Optimal Landing Location 




0 

Reachable Node 

• 

Searched Node 

■ 

Landing Footprint 


• Landing footprint is based on aircraft ground roll and impact area 

• Optimal landing location = smallest total sum cost over landing footprint 

• Found using 2D Convolution with FFT 
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Optimal Trajectory Generation 



• Dubins trajectory - gives shortest 
path between two points 

- requires final location and final heading 

- target heading here is the heading 
required to reach final landing location 

• Two basic maneuvers 

- Gliding (maximize glide range) 



- Turning (final orientation) 

• Optimal turn radius - minimize 
energy loss with a constant radius 
turn 
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WTL2 C Code 

• Dependencies 

- GSL (Numerical Library) 

- GDAL (GIS Library) 

• Makefile 

- generates executable for ARM, x86 processors 

- ccompcert -> safety critical C compiler 

• v&v 

- Use JPL Flight S/W Best Practices (JPL DOCID D-60411) 

- Run code coverage tool 

- Memory debugging tool 

- Unit tests for critical functions 

- Test Cases 
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Test Cases 


Test # 

Altitude (ft) 

Latitude 

Longitude 

Initial Heading 

1 

1000 

40.70° 

-73.8726° 

270° 

2 

1000 

40.70° 

-73.8726° 

15° 

3 

1000 

40.85° 

-73.70° 

270° 

4 

4000 

40.70° 

-73.8726° 

270° 

5 

4000 

40.70° 

-73.8726° 

15° 

6 

4000 

40.85° 

-73.70° 

270° 

7 

4000 

40.85° 

-73.70° 

15° 

8 

3026 

40.865 

-73.88° 

220 


• Altitude variation - Bounded by two altitudes 

- Altitude < 1000 ft -> Can only land straight ahead 

- Altitude > 4000 ft -> Should be able to return to airport 

• Heading variation - Show effects of initial heading on trajectory 

• Position variation - Show effects of initial position on trajectory 

• Case #8 replicates US Airways 1549 failure 

www.nasa.gov 
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Results: Test Case 1 



Altitude 

1000 ft 

Heading 

270° 

Latitude 

40.7000° 

Longitude 

-73.8726° 


land at [684.769) 
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Results: Test Case 2 



Altitude 

1000 ft 

Heading 

15° 

Latitude 

40.7000° 

Longitude 

-73.8726° 


land at [515,1032] 
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Results: Test Case 3 



Altitude 

1000 ft 

Heading 

270° 

Latitude 

40.85° 

Longitude 

-73.70° 


land at [717,727] 
1 u 


0 

Reachable location 

+ 

Current location 

■ 

Landing location 

— 

Landing trajectory 



Cost 


1.0 


0.5 
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Results: Test Case 4 



Altitude 

4000 ft 

Heading 

270° 

Latitude 

40.7000° 

Longitude 

-73.8726° 
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Results: Test Case 5 



Altitude 

4000 ft 

Heading 

15° 

Latitude 

40.7000° 

Longitude 

-73.8726° 
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Results: Test Case 6 



Altitude 

4000 ft 

Heading 

270° 

Latitude 

40.85° 

Longitude 

-73.70° 


600- 


800- 


1000 
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Results: Test Case 7 



Altitude 

4000 ft 

Heading 

15° 

Latitude 

40.85° 

Longitude 

-73.70° 
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Results: Test Case 8 



Altitude 

3026 ft 

Heading 
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Lat Long. Spd. AIL 
kts feet 


TIME 

03:26PM 40.48 -73.52 151 1806* 
03:27PM 40.50 II h I I Ml IIHUIT 
03:27PM 40.5^73753 194 3200* 
03:28PM 4^3 -73.54 202 200* 
4o.52 -73.56 215 160* 
40.50 -73.57 194 120* 
M 40.49 -73.58 191 13001 
40.47 -74.00 189 40* 

^40.45 -74.01 153 30* 




f 



/) ersey 




US Airways 1549 ground track 


NTSB accident reconstruction 
on Airbus simulator 


US Airways Flight 154! 
January 15, 2009 
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WTL2 HIL Simulation 




www.nasa.gov 


36 



National Aeronautics and Space Administration 


Future Work 



• “Online” WTL -> Fast Estimator/Online Reachable Set 

• “Adaptive” WTL -> Dynamic trajectories 

• WTL on Smartphones, Linux, PixHawk 

• WTL + RTA (Run Time Assurance) framework 

• WTL + Backward Reachable Controllers 


WTL2 (current) 


Common A/C 
Faults 


Any aerial vehicle 


Linux, Mobile, 
PixHawk 


Global Dynamic 
Cost Map 

WTL3+ (future) 


Loss of Thrust 


TCM/B-757 


Linux 


Local Static Cost 
Map 
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Impact 

* General Aviation 

- Pilots tend to less experienced 

- Mostly single engine aircraft 

* Commercial 

- Pilots are experienced and well trained 

- Multi engine aircraft 

* Unmanned Vehicles 

- Flight Termination Systems 

- Lost Link Mode 



General Aviation 

Can improve odds of survival 

Commercial 

Gives pilots more options 

Unmanned Vehicles 

Can enable expanded UAS in the NAS 
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Distribution 

1 . WTL Design: AIAA Conference Paper 

2. WTL2 Implementation: AIAA Conference Paper 

3. WTL2 NASA Technical Memo 

4. NASA NARI Presentation 
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